Their claim, rightly or wrongly, is that it came from private data (a researcher got an exposed key and downloaded data with coordinates).

But I think as long as Proton wasn't that researcher, there's no case to argue there.